<!DOCTYPE html>
<html>
<head><meta name="generator" content="Hexo 3.8.0">
  <meta charset="utf-8">
  

  
  <title>springMVC整合shiro | Hexo</title>
  <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
  <meta name="description" content="官网：https://shiro.apache.org/">
<meta name="keywords" content="shiro">
<meta property="og:type" content="article">
<meta property="og:title" content="springMVC整合shiro">
<meta property="og:url" content="http://yoursite.com/2018/10/12/2018-02-02-在spring框架中集成shiro/index.html">
<meta property="og:site_name" content="Hexo">
<meta property="og:description" content="官网：https://shiro.apache.org/">
<meta property="og:locale" content="default">
<meta property="og:image" content="http://p1aoqp63y.bkt.clouddn.com/722072-20170430205230569-1405445884.png">
<meta property="og:image" content="http://p1aoqp63y.bkt.clouddn.com/722072-20170430205312397-338437540.png">
<meta property="og:updated_time" content="2018-11-01T14:24:04.922Z">
<meta name="twitter:card" content="summary">
<meta name="twitter:title" content="springMVC整合shiro">
<meta name="twitter:description" content="官网：https://shiro.apache.org/">
<meta name="twitter:image" content="http://p1aoqp63y.bkt.clouddn.com/722072-20170430205230569-1405445884.png">
  
    <link rel="alternate" href="/org/atom.xml" title="Hexo" type="application/atom+xml">
  
  
    <link rel="icon" href="/favicon.png">
  
  
    <link href="//fonts.googleapis.com/css?family=Source+Code+Pro" rel="stylesheet" type="text/css">
  
  <link rel="stylesheet" href="/org/css/style.css">
</head>
</html>
<body>
  <div id="container">
    <div id="wrap">
      <header id="header">
  <div id="banner"></div>
  <div id="header-outer" class="outer">
    <div id="header-title" class="inner">
      <h1 id="logo-wrap">
        <a href="/org/" id="logo">Hexo</a>
      </h1>
      
    </div>
    <div id="header-inner" class="inner">
      <nav id="main-nav">
        <a id="main-nav-toggle" class="nav-icon"></a>
        
          <a class="main-nav-link" href="/org/">Home</a>
        
          <a class="main-nav-link" href="/org/archives">Archives</a>
        
      </nav>
      <nav id="sub-nav">
        
          <a id="nav-rss-link" class="nav-icon" href="/org/atom.xml" title="RSS Feed"></a>
        
        <a id="nav-search-btn" class="nav-icon" title="Search"></a>
      </nav>
      <div id="search-form-wrap">
        <form action="//google.com/search" method="get" accept-charset="UTF-8" class="search-form"><input type="search" name="q" class="search-form-input" placeholder="Search"><button type="submit" class="search-form-submit">&#xF002;</button><input type="hidden" name="sitesearch" value="http://yoursite.com"></form>
      </div>
    </div>
  </div>
</header>
      <div class="outer">
        <section id="main"><article id="post-2018-02-02-在spring框架中集成shiro" class="article article-type-post" itemscope="" itemprop="blogPost">
  <div class="article-meta">
    <a href="/org/2018/10/12/2018-02-02-在spring框架中集成shiro/" class="article-date">
  <time datetime="2018-10-12T09:03:30.000Z" itemprop="datePublished">2018-10-12</time>
</a>
    
  </div>
  <div class="article-inner">
    
    
      <header class="article-header">
        
  
    <h1 class="article-title" itemprop="name">
      springMVC整合shiro
    </h1>
  

      </header>
    
    <div class="article-entry" itemprop="articleBody">
      
        <p>官网：<a href="https://shiro.apache.org/" target="_blank" rel="noopener">https://shiro.apache.org/</a></p>
<a id="more"></a>
<h3 id="下载"><a href="#下载" class="headerlink" title="下载"></a>下载</h3><p>在Maven项目中的依赖配置如下:</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br></pre></td><td class="code"><pre><span class="line">&lt;!-- shiro配置 --&gt;</span><br><span class="line">&lt;dependency&gt;</span><br><span class="line">　　&lt;groupId&gt;org.apache.shiro&lt;/groupId&gt;</span><br><span class="line">   &lt;artifactId&gt;shiro-core&lt;/artifactId&gt;</span><br><span class="line">   &lt;version&gt;$&#123;version.shiro&#125;&lt;/version&gt;</span><br><span class="line">&lt;/dependency&gt;</span><br><span class="line">&lt;!-- Enables support for web-based applications. --&gt;</span><br><span class="line">&lt;dependency&gt;</span><br><span class="line">　　&lt;groupId&gt;org.apache.shiro&lt;/groupId&gt;</span><br><span class="line">   &lt;artifactId&gt;shiro-web&lt;/artifactId&gt;</span><br><span class="line">   &lt;version&gt;$&#123;version.shiro&#125;&lt;/version&gt;</span><br><span class="line">&lt;/dependency&gt;</span><br><span class="line">&lt;!-- Enables AspectJ support for Shiro AOP and Annotations. --&gt;</span><br><span class="line">&lt;dependency&gt;</span><br><span class="line">　　&lt;groupId&gt;org.apache.shiro&lt;/groupId&gt;</span><br><span class="line">   &lt;artifactId&gt;shiro-aspectj&lt;/artifactId&gt;</span><br><span class="line">   &lt;version&gt;$&#123;version.shiro&#125;&lt;/version&gt;</span><br><span class="line">&lt;/dependency&gt;</span><br><span class="line">&lt;!-- Enables Ehcache-based famework caching. --&gt;</span><br><span class="line">&lt;dependency&gt;</span><br><span class="line">　　&lt;groupId&gt;org.apache.shiro&lt;/groupId&gt;</span><br><span class="line">   &lt;artifactId&gt;shiro-ehcache&lt;/artifactId&gt;</span><br><span class="line">   &lt;version&gt;$&#123;version.shiro&#125;&lt;/version&gt;</span><br><span class="line">&lt;/dependency&gt;</span><br><span class="line">&lt;!-- Enables Spring Framework integration. --&gt;</span><br><span class="line">&lt;dependency&gt;</span><br><span class="line">　　&lt;groupId&gt;org.apache.shiro&lt;/groupId&gt;</span><br><span class="line">   &lt;artifactId&gt;shiro-spring&lt;/artifactId&gt;</span><br><span class="line">   &lt;version&gt;$&#123;version.shiro&#125;&lt;/version&gt;</span><br><span class="line">&lt;/dependency&gt;</span><br></pre></td></tr></table></figure>
<p><strong>特别地！</strong>Shiro使用了日志框架slf4j，因此需要对应配置指定的日志实现组件，如：log4j，logback等。<br>在此，以使用log4j为日志实现为例：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line">&lt;!-- 日志工具 --&gt;</span><br><span class="line">&lt;!--</span><br><span class="line">shiro使用slf4j作为日志框架，所以必需配置slf4j。</span><br><span class="line">同时，使用log4j作为底层的日志实现框架。</span><br><span class="line">--&gt;</span><br><span class="line">&lt;dependency&gt;</span><br><span class="line">　　&lt;groupId&gt;org.slf4j&lt;/groupId&gt;</span><br><span class="line">　　&lt;artifactId&gt;slf4j-api&lt;/artifactId&gt;</span><br><span class="line">　　&lt;version&gt;1.7.25&lt;/version&gt;</span><br><span class="line">&lt;/dependency&gt;</span><br><span class="line">&lt;dependency&gt;</span><br><span class="line">　　&lt;groupId&gt;org.slf4j&lt;/groupId&gt;</span><br><span class="line">　　&lt;artifactId&gt;slf4j-log4j12&lt;/artifactId&gt;</span><br><span class="line">　　&lt;version&gt;1.7.25&lt;/version&gt;</span><br><span class="line">&lt;/dependency&gt;</span><br><span class="line">&lt;dependency&gt;</span><br><span class="line">　　&lt;groupId&gt;log4j&lt;/groupId&gt;</span><br><span class="line">　　&lt;artifactId&gt;log4j&lt;/artifactId&gt;</span><br><span class="line">　　&lt;version&gt;1.2.17&lt;/version&gt;</span><br><span class="line">&lt;/dependency&gt;</span><br></pre></td></tr></table></figure>
<h3 id="集成shiro"><a href="#集成shiro" class="headerlink" title="集成shiro"></a>集成shiro</h3><p>在Spring框架中集成shiro,本质上是与Sping Ioc 容器和SpringMVC框架集成，所以应该分两部分来说.</p>
<p>(1)与Spring IoC容器集成</p>
<p>Spring IoC容器提供了一个非常重要的功能，就是依赖注入，将Bean的定义以及Bean之间关系的耦合通过容器来处理。<br>也就是说，在Spring中集成Shiro时，Shiro中的相应Bean的定义以及他们的关系也需要通过Spring IoC容器实现，配置如下</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br></pre></td><td class="code"><pre><span class="line">&lt;bean id=&quot;shiroFilter&quot; class=&quot;org.apache.shiro.spring.web.ShiroFilterFactoryBean&quot;&gt;</span><br><span class="line">  &lt;property name=&quot;securityManager&quot; ref=&quot;securityManager&quot;/&gt;</span><br><span class="line">  &lt;property name=&quot;loginUrl&quot; value=&quot;/index&quot;/&gt;</span><br><span class="line">  &lt;property name=&quot;successUrl&quot; value=&quot;/home&quot;/&gt;</span><br><span class="line">  &lt;property name=&quot;unauthorizedUrl&quot; value=&quot;/unauthorized.jsp&quot;/&gt;</span><br><span class="line">  &lt;!-- The &apos;filters&apos; property is not necessary since any declared javax.servlet.Filter bean  --&gt;</span><br><span class="line">  &lt;!-- defined will be automatically acquired and available via its beanName in chain        --&gt;</span><br><span class="line">  &lt;!-- definitions, but you can perform instance overrides or name aliases here if you like: --&gt;</span><br><span class="line">  &lt;!-- &lt;property name=&quot;filters&quot;&gt;</span><br><span class="line">      &lt;util:map&gt;</span><br><span class="line">          &lt;entry key=&quot;logout&quot; value-ref=&quot;logoutFilter&quot; /&gt;</span><br><span class="line">      &lt;/util:map&gt;</span><br><span class="line">  &lt;/property&gt; --&gt;</span><br><span class="line">  &lt;property name=&quot;filterChainDefinitions&quot;&gt;</span><br><span class="line">      &lt;value&gt;</span><br><span class="line">          # some example chain definitions:</span><br><span class="line">          # /admin/** = authc, roles[admin]</span><br><span class="line">          # /docs/** = authc, perms[document:read]</span><br><span class="line">          /login = anon</span><br><span class="line">          /logout = anon</span><br><span class="line">          /error = anon</span><br><span class="line">          /** = user</span><br><span class="line">          # more URL-to-FilterChain definitions here</span><br><span class="line">      &lt;/value&gt;</span><br><span class="line">  &lt;/property&gt;</span><br><span class="line">&lt;/bean&gt;</span><br><span class="line">&lt;bean id=&quot;securityManager&quot; class=&quot;org.apache.shiro.web.mgt.DefaultWebSecurityManager&quot;&gt;</span><br><span class="line">  &lt;!-- Single realm app.  If you have multiple realms, use the &apos;realms&apos; property instead. --&gt;</span><br><span class="line">  &lt;property name=&quot;realm&quot; ref=&quot;myRealm&quot; /&gt;</span><br><span class="line">  &lt;!-- By default the servlet container sessions will be used.  Uncomment this line</span><br><span class="line">       to use shiro&apos;s native sessions (see the JavaDoc for more): --&gt;</span><br><span class="line">  &lt;!-- &lt;property name=&quot;sessionMode&quot; value=&quot;native&quot;/&gt; --&gt;</span><br><span class="line">&lt;/bean&gt;</span><br><span class="line">&lt;bean id=&quot;lifecycleBeanPostProcessor&quot; class=&quot;org.apache.shiro.spring.LifecycleBeanPostProcessor&quot;/&gt;</span><br><span class="line"></span><br><span class="line">&lt;!-- Define the Shiro Realm implementation you want to use to connect to your back-end --&gt;</span><br><span class="line">&lt;!-- security datasource: --&gt;</span><br><span class="line">&lt;bean id=&quot;myRealm&quot; class=&quot;org.apache.shiro.realm.jdbc.JdbcRealm&quot;&gt;</span><br><span class="line">  &lt;property name=&quot;dataSource&quot; ref=&quot;dataSource&quot;/&gt;</span><br><span class="line">  &lt;property name=&quot;permissionsLookupEnabled&quot; value=&quot;true&quot;/&gt;</span><br><span class="line">&lt;/bean&gt;</span><br><span class="line"></span><br><span class="line">&lt;!-- Enable Shiro Annotations for Spring-configured beans.  Only run after --&gt;</span><br><span class="line">&lt;!-- the lifecycleBeanProcessor has run: --&gt;</span><br><span class="line">&lt;bean class=&quot;org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator&quot; depends-on=&quot;lifecycleBeanPostProcessor&quot;/&gt;</span><br><span class="line">&lt;bean class=&quot;org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor&quot;&gt;</span><br><span class="line">  &lt;property name=&quot;securityManager&quot; ref=&quot;securityManager&quot;/&gt;</span><br><span class="line">&lt;/bean&gt;</span><br></pre></td></tr></table></figure>
<p>（2）与Spring MVC集成</p>
<p>跟在普通Java Web应用中使用Shiro一样，集成Shiro到Spring MVC时，实际上就是通过在web.xml中添加指定Filter实现。配置如下</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">&lt;!-- The filter-name matches name of a &apos;shiroFilter&apos; bean inside applicationContext.xml --&gt;</span><br><span class="line">&lt;filter&gt;</span><br><span class="line">    &lt;filter-name&gt;shiroFilter&lt;/filter-name&gt;</span><br><span class="line">    &lt;filter-class&gt;org.springframework.web.filter.DelegatingFilterProxy&lt;/filter-class&gt;</span><br><span class="line">    &lt;init-param&gt;</span><br><span class="line">        &lt;param-name&gt;targetFilterLifecycle&lt;/param-name&gt;</span><br><span class="line">        &lt;param-value&gt;true&lt;/param-value&gt;</span><br><span class="line">    &lt;/init-param&gt;</span><br><span class="line">&lt;/filter&gt;</span><br><span class="line"></span><br><span class="line">&lt;!-- Make sure any request you want accessible to Shiro is filtered. /* catches all --&gt;</span><br><span class="line">&lt;!-- requests.  Usually this filter mapping is defined first (before all others) to --&gt;</span><br><span class="line">&lt;!-- ensure that Shiro works in subsequent filters in the filter chain:             --&gt;</span><br><span class="line">&lt;filter-mapping&gt;</span><br><span class="line">    &lt;filter-name&gt;shiroFilter&lt;/filter-name&gt;</span><br><span class="line">    &lt;url-pattern&gt;/*&lt;/url-pattern&gt;</span><br><span class="line">&lt;/filter-mapping&gt;</span><br></pre></td></tr></table></figure>
<p>也就是说，其实在Spring中集成Shiro的原理就是：通过在web.xml中配置的Shiro Filter与Spring IoC中定义的相应的Shiro Bean定义建立关系，从而实现在Spring框架集成Shiro。<br>实际上，通常就是在web.xml添加的Filter与某个Shiro Spring Bean的定义name是相同的，参见示例</p>
<p>Shiro Filter类图：</p>
<p><img src="http://p1aoqp63y.bkt.clouddn.com/722072-20170430205230569-1405445884.png" alt="1"></p>
<h3 id="3-数据源配置"><a href="#3-数据源配置" class="headerlink" title="3.数据源配置"></a>3.数据源配置</h3><p>在Shiro中，Realm定义了访问数据的方式，用来连接不同的数据源，如：LDAP，关系数据库，配置文件等等。<br>Realm类图：</p>
<p><img src="http://p1aoqp63y.bkt.clouddn.com/722072-20170430205312397-338437540.png" alt="2"></p>
<p>也就是说，可以根据实际需求及应用的权限管理复杂度灵活选择指定数据源;</p>
<p>在此，以org.apache.shiro.realm.jdbc.JdbcRealm为例，将用户信息存放在关系型数据库中。</p>
<p>在使用org.apache.shiro.realm.jdbc.JdbcRealm时，必须要在关系型数据库中存在3张表，分别是：<br>（1）users表，存放认证用户基本信息，在该表中必须存在2个字段：username，password。<br>（2）roles_permissions表，存放角色和权限定义，在该表中必须存在2个字段：role_name，permission。<br>（3）user_roles表，存放用户角色对应关系，在该表中必须存在2个字段：username，role_name。<br>实际上，在更加复杂的应用场景下，通常需要扩展org.apache.shiro.realm.jdbc.JdbcRealm。</p>
<h3 id="4-认证"><a href="#4-认证" class="headerlink" title="4.认证"></a>4.认证</h3><p>在Shiro中，认证即执行用户登录，读取指定Realm连接的数据源，以验证用户身份的有效性与合法性。<br>关于Shiro在Web应用中的认证流程，与Shiro在非Web环境的独立应用中的认证流程一样，都需要执行用户登录，即：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">Subject currentUser = SecurityUtils.getSubject();</span><br><span class="line">if(!currentUser.isAuthenticated()) &#123;</span><br><span class="line">　　UsernamePasswordToken token = new UsernamePasswordToken(name, password);</span><br><span class="line">　　try &#123;</span><br><span class="line">　　　　currentUser.login(token);</span><br><span class="line">　　&#125; catch (UnknownAccountException e) &#123;</span><br><span class="line">　　　　logger.error(String.format(&quot;user not found: %s&quot;, name), e);</span><br><span class="line">　　&#125; catch(IncorrectCredentialsException e) &#123;</span><br><span class="line">　　　　logger.error(String.format(&quot;user: %s pwd: %s error&quot;, name, password), e);</span><br><span class="line">　　&#125; catch (ConcurrentAccessException e) &#123;</span><br><span class="line">　　　　logger.error(String.format(&quot;user has been authenticated: %s&quot;, name), e);</span><br><span class="line">　　&#125; catch (AuthenticationException e) &#123;</span><br><span class="line">　　　　logger.error(String.format(&quot;account except: %s&quot;, name), e);</span><br><span class="line">　　&#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<p>唯一的区别就是，在Java Web环境中，用户名和密码参数是通过前端页面进行传递</p>
<h3 id="5-授权"><a href="#5-授权" class="headerlink" title="5.授权"></a>5.授权</h3><p><strong>需要再三强调！！！</strong>Shiro作为权限框架，仅仅只能控制对资源的操作权限，并不能完成对数据权限的业务需求。<br>而对于Java Web环境下Shiro授权，包含个方面的含义。<br>其一，对于前端来说，用户只能看到他对应访问权限的元素。<br>其二，当用户执行指定操作（即：访问某个uri资源）时，需要验证用户是否具备对应权限。<br>对于第一点，在Java Web环境下，通过Shiro提供的JSP标签实现。</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">&lt;shiro:hasRole name=&quot;admin&quot;&gt;</span><br><span class="line">　　&lt;a&gt;用户管理&lt;/a&gt;</span><br><span class="line">&lt;/shiro:hasRole&gt;</span><br><span class="line">&lt;shiro:hasPermission name=&quot;winnebago:drive:eagle5&quot;&gt;</span><br><span class="line">　　&lt;a&gt;操作审计&lt;/a&gt;</span><br><span class="line">&lt;/shiro:hasPermission&gt;</span><br></pre></td></tr></table></figure>
<p>必须在jsp页面中引入shiro标签库：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&lt;%@ taglib prefix=&quot;shiro&quot; uri=&quot;http://shiro.apache.org/tags&quot; %&gt;</span><br></pre></td></tr></table></figure>
<p>在Spring框架中集成Shiro，还可以直接通过Java注解方式实现:</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">@Controller</span><br><span class="line">public class HomeController &#123;</span><br><span class="line">　　@RequestMapping(&quot;/home&quot;)</span><br><span class="line">　　@RequiresPermissions(value=&#123;&quot;log:manage:*&quot;&#125;)</span><br><span class="line">　　public ModelAndView home(HttpServletRequest req) &#123;</span><br><span class="line">　　　　ModelAndView mv = new ModelAndView(&quot;home&quot;);</span><br><span class="line">　　　　return mv;</span><br><span class="line">　　&#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>
<h3 id="6-Spring集成Shiro注意事项"><a href="#6-Spring集成Shiro注意事项" class="headerlink" title="6.Spring集成Shiro注意事项"></a>6.<strong>Spring集成Shiro注意事项</strong></h3><p>假设存在如下几个配置文件，分别是：<br>springDAO.xml：数据源定义<br>springMVC.xml：Spring MVC配置<br>springService.xml：其他Spring组件配置<br>springShiro.xml：Shiro相关Bean配置</p>
<p>第一，在不同版本的Spring中集成Shiro，实现方式不同。<br>（1）在Spring 4.2.0 RELEASE+版本中集成Shiro：<br>web.xml：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line">&lt;servlet&gt;</span><br><span class="line">　　&lt;servlet-name&gt;SpringMVC&lt;/servlet-name&gt;</span><br><span class="line">　　&lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;</span><br><span class="line">　　&lt;init-param&gt;</span><br><span class="line">　　　　&lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;</span><br><span class="line">　　　　&lt;param-value&gt;classpath:/spring*.xml&lt;/param-value&gt;</span><br><span class="line">　　&lt;/init-param&gt;</span><br><span class="line">　　&lt;load-on-startup&gt;1&lt;/load-on-startup&gt;</span><br><span class="line">&lt;/servlet&gt;</span><br><span class="line">&lt;servlet-mapping&gt;</span><br><span class="line">　　&lt;servlet-name&gt;SpringMVC&lt;/servlet-name&gt;</span><br><span class="line">　　&lt;url-pattern&gt;/&lt;/url-pattern&gt;</span><br><span class="line">&lt;/servlet-mapping&gt;</span><br></pre></td></tr></table></figure>
<p>（2）在Spring 4.1.9 RELEASE-版本中集成Shiro：<br>web.xml：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line">&lt;listener&gt;</span><br><span class="line">　　&lt;listener-class&gt;org.springframework.web.context.ContextLoaderListener&lt;/listener-class&gt;</span><br><span class="line">&lt;/listener&gt;</span><br><span class="line">&lt;context-param&gt;</span><br><span class="line">　　&lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;</span><br><span class="line">　　&lt;param-value&gt;classpath:/springDAO.xml,classpath:/springService.xml,classpath:/springShiro.xml&lt;/param-value&gt;</span><br><span class="line">&lt;/context-param&gt;</span><br><span class="line">&lt;servlet&gt;</span><br><span class="line">　　&lt;servlet-name&gt;SpringMVC&lt;/servlet-name&gt;</span><br><span class="line">　　&lt;servlet-class&gt;org.springframework.web.servlet.DispatcherServlet&lt;/servlet-class&gt;</span><br><span class="line">　　&lt;init-param&gt;</span><br><span class="line">　　　　&lt;param-name&gt;contextConfigLocation&lt;/param-name&gt;</span><br><span class="line">　　　　&lt;param-value&gt;classpath:/springMVC.xml&lt;/param-value&gt;</span><br><span class="line">　　&lt;/init-param&gt;</span><br><span class="line">　　&lt;load-on-startup&gt;1&lt;/load-on-startup&gt;</span><br><span class="line">&lt;/servlet&gt;</span><br><span class="line">&lt;servlet-mapping&gt;</span><br><span class="line">　　&lt;servlet-name&gt;SpringMVC&lt;/servlet-name&gt;</span><br><span class="line">　　&lt;url-pattern&gt;/&lt;/url-pattern&gt;</span><br><span class="line">&lt;/servlet-mapping&gt;</span><br></pre></td></tr></table></figure>
<p>同时，还需要将在springShiro.xml中配置的org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator放到springMVC.xml中，即：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">&lt;!-- 解决在spring 4.1.9 RELEASE及以下版本，集成shiro时注解不生效的问题 --&gt;</span><br><span class="line">&lt;bean class=&quot;org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator&quot;</span><br><span class="line">depends-on=&quot;lifecycleBeanPostProcessor&quot;/&gt;</span><br></pre></td></tr></table></figure>
<p>第二，虽然shiro的注解定义是在Class级别的，但是实际验证只能支持方法级别：<br>@RequiresAuthentication<br>@RequiresPermissions<br>@RequiresRoles</p>

      
    </div>
    <footer class="article-footer">
      <a data-url="http://yoursite.com/2018/10/12/2018-02-02-在spring框架中集成shiro/" data-id="cjoztxu24000c1wij2sqooqp5" class="article-share-link">Share</a>
      
      
  <ul class="article-tag-list"><li class="article-tag-list-item"><a class="article-tag-list-link" href="/org/tags/shiro/">shiro</a></li></ul>

    </footer>
  </div>
  
    
<nav id="article-nav">
  
    <a href="/org/2018/10/12/2018-02-25-认识SpringMVC/" id="article-nav-newer" class="article-nav-link-wrap">
      <strong class="article-nav-caption">Newer</strong>
      <div class="article-nav-title">
        
          SpringMVC的helloworld
        
      </div>
    </a>
  
  
    <a href="/org/2018/10/12/2018-02-01-在web应用中使用shiro/" id="article-nav-older" class="article-nav-link-wrap">
      <strong class="article-nav-caption">Older</strong>
      <div class="article-nav-title">在web应用中使用shiro</div>
    </a>
  
</nav>

  
</article>

</section>
        
          <aside id="sidebar">
  
    

  
    
  <div class="widget-wrap">
    <h3 class="widget-title">Tags</h3>
    <div class="widget">
      <ul class="tag-list"><li class="tag-list-item"><a class="tag-list-link" href="/org/tags/SVN/">SVN</a></li><li class="tag-list-item"><a class="tag-list-link" href="/org/tags/Spring-secrity/">Spring-secrity</a></li><li class="tag-list-item"><a class="tag-list-link" href="/org/tags/hexo/">hexo</a></li><li class="tag-list-item"><a class="tag-list-link" href="/org/tags/hibenrate/">hibenrate</a></li><li class="tag-list-item"><a class="tag-list-link" href="/org/tags/jekyll/">jekyll</a></li><li class="tag-list-item"><a class="tag-list-link" href="/org/tags/jenkins/">jenkins</a></li><li class="tag-list-item"><a class="tag-list-link" href="/org/tags/redis/">redis</a></li><li class="tag-list-item"><a class="tag-list-link" href="/org/tags/shiro/">shiro</a></li><li class="tag-list-item"><a class="tag-list-link" href="/org/tags/spingMVC/">spingMVC</a></li><li class="tag-list-item"><a class="tag-list-link" href="/org/tags/spring-cloud/">spring cloud</a></li><li class="tag-list-item"><a class="tag-list-link" href="/org/tags/spring-cloud/">spring-cloud</a></li><li class="tag-list-item"><a class="tag-list-link" href="/org/tags/spring-secrity/">spring-secrity</a></li><li class="tag-list-item"><a class="tag-list-link" href="/org/tags/springMVC/">springMVC</a></li><li class="tag-list-item"><a class="tag-list-link" href="/org/tags/springboot/">springboot</a></li><li class="tag-list-item"><a class="tag-list-link" href="/org/tags/生活/">生活</a></li></ul>
    </div>
  </div>


  
    
  <div class="widget-wrap">
    <h3 class="widget-title">Tag Cloud</h3>
    <div class="widget tagcloud">
      <a href="/org/tags/SVN/" style="font-size: 12px;">SVN</a> <a href="/org/tags/Spring-secrity/" style="font-size: 10px;">Spring-secrity</a> <a href="/org/tags/hexo/" style="font-size: 10px;">hexo</a> <a href="/org/tags/hibenrate/" style="font-size: 10px;">hibenrate</a> <a href="/org/tags/jekyll/" style="font-size: 10px;">jekyll</a> <a href="/org/tags/jenkins/" style="font-size: 10px;">jenkins</a> <a href="/org/tags/redis/" style="font-size: 16px;">redis</a> <a href="/org/tags/shiro/" style="font-size: 18px;">shiro</a> <a href="/org/tags/spingMVC/" style="font-size: 10px;">spingMVC</a> <a href="/org/tags/spring-cloud/" style="font-size: 10px;">spring cloud</a> <a href="/org/tags/spring-cloud/" style="font-size: 10px;">spring-cloud</a> <a href="/org/tags/spring-secrity/" style="font-size: 12px;">spring-secrity</a> <a href="/org/tags/springMVC/" style="font-size: 14px;">springMVC</a> <a href="/org/tags/springboot/" style="font-size: 20px;">springboot</a> <a href="/org/tags/生活/" style="font-size: 10px;">生活</a>
    </div>
  </div>

  
    
  <div class="widget-wrap">
    <h3 class="widget-title">Archives</h3>
    <div class="widget">
      <ul class="archive-list"><li class="archive-list-item"><a class="archive-list-link" href="/org/archives/2018/11/">November 2018</a></li><li class="archive-list-item"><a class="archive-list-link" href="/org/archives/2018/10/">October 2018</a></li></ul>
    </div>
  </div>


  
    
  <div class="widget-wrap">
    <h3 class="widget-title">Recent Posts</h3>
    <div class="widget">
      <ul>
        
          <li>
            <a href="/org/2018/11/27/redis07-zookeeper-kafka集群部署以及如何使用简单介绍/">redis07-zookeeper+kafka集群部署以及如何使用简单介绍</a>
          </li>
        
          <li>
            <a href="/org/2018/11/13/redis06-cluster实现高可用性/">redis06-cluster实现高可用性</a>
          </li>
        
          <li>
            <a href="/org/2018/11/12/redis05-在项目中搭建读写分-高可用-多master的redis-cluster集群/">redis05-在项目中搭建读写分+高可用+多master的redis cluster集群</a>
          </li>
        
          <li>
            <a href="/org/2018/11/05/在项目中用经典的三节点方式部署哨兵集群-笔记/">在项目中用经典的三节点方式部署哨兵集群-笔记</a>
          </li>
        
          <li>
            <a href="/org/2018/11/05/redis哨兵的多个核心底层原理-笔记/">redis哨兵的多个核心底层原理-笔记</a>
          </li>
        
      </ul>
    </div>
  </div>

  
</aside>
        
      </div>
      <footer id="footer">
  
  <div class="outer">
    <div id="footer-info" class="inner">
      &copy; 2018 John Doe<br>
      Powered by <a href="http://hexo.io/" target="_blank">Hexo</a>
    </div>
  </div>
</footer>
    </div>
    <nav id="mobile-nav">
  
    <a href="/org/" class="mobile-nav-link">Home</a>
  
    <a href="/org/archives" class="mobile-nav-link">Archives</a>
  
</nav>
    

<script src="//code.jquery.com/jquery-2.0.3.min.js"></script>


  <link rel="stylesheet" href="/org/fancybox/jquery.fancybox.css">
  <script src="/org/fancybox/jquery.fancybox.pack.js"></script>


<script src="/org/js/script.js"></script>



  </div>
</body>
</html>